All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,770
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 11,257–11,280 of 29,770 skills
- Security Vulnerability Disclosure> A vulnerability without a disclosure process is a vulnerability that gets sold to exploit > brokers, dropped as a zero-day, or posted on Twitter -- coordinated disclosure turns > discovered vulnerabilities into patches instead of breachesVotes: 0GitHub stars: 20
- Security Vault Patterns> Centralize secrets in a vault, issue dynamic short-lived credentials, encrypt data > through a transit engine, and eliminate long-lived secrets from your infrastructureVotes: 0GitHub stars: 20
- Security Trust Boundaries> Every security control exists because data crosses from a trusted zone to a less-trusted one -- identify the boundaries first, then concentrate defenses thereVotes: 0GitHub stars: 20
- Security Tls Fundamentals> TLS 1.3 with ECDHE key exchange, AES-256-GCM or ChaCha20-Poly1305 ciphers, and valid > certificates -- the minimum bar for all network communicationVotes: 0GitHub stars: 20
- Security Threat Modeling Stride> Systematic threat identification using the six STRIDE categories -- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of PrivilegeVotes: 0GitHub stars: 20
- Security Threat Modeling Process> End-to-end threat modeling from system decomposition through threat enumeration, risk rating, and mitigation tracking -- the operational backbone of proactive security designVotes: 0GitHub stars: 20
- Security Symmetric Encryption> AES-256-GCM for most use cases, ChaCha20-Poly1305 when hardware AES is unavailable -- > always use authenticated encryption, never roll your ownVotes: 0GitHub stars: 20
- Security Shift Left Design> Find security flaws in the design document, not in the penetration test report -- because > fixing an architecture flaw costs 100x more after deployment than during designVotes: 0GitHub stars: 20
- Security Session Management> Session tokens are bearer credentials -- generate with CSPRNG, bind to client context, enforce idle and absolute timeouts, and regenerate on privilege changesVotes: 0GitHub stars: 20
- Security Security Champions> Scale security knowledge across the engineering organization by embedding trained security > advocates in every development team -- because the security team cannot review every line of > code, but developers canVotes: 0GitHub stars: 20
- Security Rebac Design> Model authorization as a graph of relationships -- "User X is an editor of Document Y which belongs to Folder Z owned by Team W" -- enabling inherited permissions that follow resource hierarchiesVotes: 0GitHub stars: 20
- Security Rbac Design> Assign permissions to roles, assign roles to users -- simple, auditable, and sufficient for most applications when combined with resource-level checksVotes: 0GitHub stars: 20
- Security Race Conditions> When security depends on the order of operations but the system does not enforce that > order, attackers exploit the gap between check and use -- turning microsecond timing windows > into privilege escalation, double-spend, and data corruptionVotes: 0GitHub stars: 20
- Security Penetration Testing> Hire skilled attackers to find the vulnerabilities your automated tools and internal reviews > miss -- then fix what they find and verify the fixesVotes: 0GitHub stars: 20
- Security Mtls Design> Both sides prove their identity with certificates -- the server authenticates to the > client and the client authenticates to the server, establishing a cryptographically > verified service-to-service channelVotes: 0GitHub stars: 20
- Security Microsegmentation> Isolate every workload behind its own perimeter -- so compromising the web server does > not hand the attacker the database, the secrets store, and the internal APIsVotes: 0GitHub stars: 20
- Security Mfa Design> Something you know, something you have, something you are -- combining authentication factors so that compromising one factor alone is insufficient to gain accessVotes: 0GitHub stars: 20
- Security Incident Containment> The first 60 minutes of a security incident determine whether the organization loses days > of data or months of data -- containment is not about fixing the vulnerability, it is about > stopping the bleeding while preserving the evidence needed to understand what happenedVotes: 0GitHub stars: 20
- Security Identity Verification> Authentication at login is necessary but insufficient -- continuously evaluate identity > confidence using device trust, behavioral signals, and environmental context throughout > the sessionVotes: 0GitHub stars: 20
- Security Hsts Preloading> Tell the browser "never connect to this domain over HTTP, ever" -- and make it permanent > by embedding the directive in every browser's shipped preload listVotes: 0GitHub stars: 20
- Security Hmac Signatures> HMAC proves a message was created by someone with the shared secret; digital signatures prove it was created by a specific private key holder -- choose based on whether you need symmetric verification or non-repudiationVotes: 0GitHub stars: 20
- Security Hashing Fundamentals> One-way functions for integrity verification, content addressing, and commitment schemes > -- SHA-256 for interoperability, BLAKE3 for performance, and never MD5 or SHA-1 for > securityVotes: 0GitHub stars: 20
- Security Fleet> Autonomous security backlog sweep — enumerate risk-ranked code areas plus the resolved dependency tree, discard every candidate that cannot produce concrete evidence, confirm one ranked batch with the human in a single up-front round, then route each survivor by a bounded-fix test: a safe bounded fix is built through the **real** pipeline into an independently verified PR, while a risky or structural finding is filed with its evidence packet instead of force-fixed. The fleet never auto-merg...Votes: 0GitHub stars: 20
- Security Deserialization Attacks> Deserialization reconstructs objects from byte streams -- and in most languages, that > reconstruction executes code, meaning an attacker who controls the serialized input controls > what code runs on your serverVotes: 0GitHub stars: 20